Skip to content

Commit b40b957

Browse files
authored
Merge pull request #635 from Classic298/patch-3
small changes to add the necessity to configure `OPENID_PROVIDER_URL` so logout works fine
2 parents 53fe789 + 362792a commit b40b957

1 file changed

Lines changed: 22 additions & 4 deletions

File tree

docs/features/sso/index.mdx

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,31 @@ Open WebUI supports several forms of federated authentication:
1414
1. OIDC
1515
1. Trusted Header
1616

17+
:::info
18+
19+
For more information about all environment variables, check out the [environment variable docs page](https://docs.openwebui.com/getting-started/env-configuration/).
20+
It is highly recommended to check the environment variable page, to get more details about how to set the variable and what values are expected.
21+
22+
:::
23+
24+
:::danger
25+
26+
Right now, you can only configure one OAUTH provider at a time.
27+
You cannot have Microsoft **and** Google as providers simultaneously.
28+
29+
:::
30+
1731
## OAuth
1832

19-
There are several global configuration options for OAuth:
33+
There are several global configuration options for OAuth in general:
2034

2135
1. `ENABLE_OAUTH_SIGNUP` - if `true`, allows accounts to be created when logging in with OAuth. Distinct from `ENABLE_SIGNUP`.
2236
1. `OAUTH_MERGE_ACCOUNTS_BY_EMAIL` - allows logging into an account that matches the email address provided by the OAuth provider.
2337
- This is considered insecure as not all OAuth providers verify email addresses, and may allow accounts to be hijacked.
2438
1. `OAUTH_UPDATE_PICTURE_ON_LOGIN` - if `true`, users will have OAuth-provided profile pictures updated on login.
2539
- If the OAuth picture claim is disabled by setting `OAUTH_PICTURE_CLAIM` to the empty string, this configuration will be ignored.
2640
1. `OAUTH_PICTURE_CLAIM` - can be used to customize or disable profile picture storage. The default, `picture`, will work for most providers; if set to the empty string, all users will receive the default person profile picture.
41+
1. `WEBUI_AUTH_SIGNOUT_REDIRECT_URI` - can be set to optionally forward the user to a specific URI after logging out.
2742

2843
### Google
2944

@@ -34,6 +49,7 @@ The following environment variables are required:
3449

3550
1. `GOOGLE_CLIENT_ID` - Google OAuth client ID
3651
1. `GOOGLE_CLIENT_SECRET` - Google OAuth client secret
52+
1. `OPENID_PROVIDER_URL` - Must be set for logout to work properly.
3753

3854
### Microsoft
3955

@@ -45,9 +61,10 @@ Support for Microsoft OAuth is currently limited to a single tenant, that is a s
4561
The following environment variables are required:
4662

4763
1. `MICROSOFT_CLIENT_ID` - Microsoft OAuth client ID
48-
2. `MICROSOFT_CLIENT_SECRET` - Microsoft OAuth client secret
49-
3. `MICROSOFT_CLIENT_TENANT_ID` - Microsoft tenant ID - use `9188040d-6c67-4c5b-b112-36a304b66dad` for personal accounts
50-
4. `MICROSOFT_REDIRECT_URI` - The redirect URI configured in your Microsoft OAuth application. This must be set to `<open-webui>/oauth/microsoft/callback`.
64+
1. `MICROSOFT_CLIENT_SECRET` - Microsoft OAuth client secret
65+
1. `MICROSOFT_CLIENT_TENANT_ID` - Microsoft tenant ID - use `9188040d-6c67-4c5b-b112-36a304b66dad` for personal accounts
66+
1. `MICROSOFT_REDIRECT_URI` - The redirect URI configured in your Microsoft OAuth application. This must be set to `<open-webui>/oauth/microsoft/callback`.
67+
1. `OPENID_PROVIDER_URL` - Must be set for logout to work properly.
5168

5269
### Github
5370

@@ -58,6 +75,7 @@ The following environment variables are required:
5875

5976
1. `GITHUB_CLIENT_ID` - Github OAuth App Client ID
6077
1. `GITHUB_CLIENT_SECRET` - Github OAuth App Client Secret
78+
1. `OPENID_PROVIDER_URL` - Must be set for logout to work properly.
6179

6280
### OIDC
6381

0 commit comments

Comments
 (0)